diff --git a/storages/forms.py b/storages/forms.py
index 9a5fadee..4025d0e1 100644
--- a/storages/forms.py
+++ b/storages/forms.py
@@ -38,7 +38,10 @@ class AddStgPool(forms.Form):
     def clean_target(self):
         storage_type = self.cleaned_data["stg_type"]
         target = self.cleaned_data["target"]
-        have_symbol = re.match(r"^[^-](\/?((?:[0-9a-zA-Z_])|(?:\.)|((?<!\/)-))*)+$", target)
+        # letters, digits, "_", ".", "/" and "-" not right after "/"; not
+        # starting with "-". Written without nested repetition, which
+        # backtracked exponentially on crafted input.
+        have_symbol = re.match(r"^[^-](?:[/0-9a-zA-Z_.]|(?<!/)-)*$", target)
         if storage_type in ["dir", "netfs"] and not have_symbol:
             raise forms.ValidationError(
                 _("The target must not contain any special characters")
diff --git a/storages/test_pool_target.py b/storages/test_pool_target.py
new file mode 100644
index 00000000..207dcb06
--- /dev/null
+++ b/storages/test_pool_target.py
@@ -0,0 +1,33 @@
+"""The storage pool target check runs in linear time and accepts what it did."""
+
+import time
+
+from django.test import SimpleTestCase
+from storages.forms import AddStgPool
+
+
+def target_error(target):
+    form = AddStgPool({"name": "pool1", "stg_type": "dir", "target": target})
+    form.is_valid()
+    return "target" in form.errors
+
+
+class PoolTargetTests(SimpleTestCase):
+    def test_accepted_and_refused_targets(self):
+        for target, refused in (
+            ("/var/lib/libvirt/images", False),
+            ("/srv/iso-pool", False),
+            ("/a//b", False),
+            ("a-b.c_d/e", False),
+            ("/a/-b", True),  # a dash right after a slash
+            ("-x", True),
+            ("/a b", True),
+        ):
+            with self.subTest(target=target):
+                self.assertEqual(target_error(target), refused)
+
+    def test_a_crafted_target_is_checked_at_once(self):
+        # the previous expression backtracked exponentially: 22 dashes took over a second
+        start = time.monotonic()
+        self.assertTrue(target_error("," + "-" * 98 + "!"))
+        self.assertLess(time.monotonic() - start, 1)